Build Information Security Awareness in Your Workplace
YOUNGSTOWN, Ohio – Your company may have made a commitment to building information security awareness among employees, but how much of that commitment has been put into practice? Educating both employees and executive staff on cybersecurity awareness is more important now than ever. When security precautions aren’t taken seriously, cyber-attacks – in the form of phishing, spear-phishing, whaling emails, watering holes, to name only a few of the sinister threats out there–can potentially bring a business to its knees.
If you haven’t yet formally implemented information security awareness training, here are some key tips to keep in mind:
Employees often feel that the company’s IT infrastructure is sophisticated enough to handle cyber-attacks, and they relax their guard by occasionally undertaking risky behavior with their company desktop, laptop, or mobile devices. This misconception should be cleared up immediately! Cybersecurity experts agree that employees are the first-line of defense and their role in safeguarding company data must not be ignored.
But while education is paramount, “a balance needs to be struck,” writes Hugh Wilson at The Telegraph. “Employees need to know the risk their online activities pose and how to manage it, without being rendered unproductive by overly complex procedures.”
Some businesses mandate a single session of cybersecurity training for employees and then leave the rest up to them. The best way to address this challenge is by instilling data security awareness into the fabric of your company culture, from a new hire’s first day on the job to ongoing refresher-training at regularly scheduled intervals. A steady program of training will convince employees that you take the subject very seriously, and they’ll be much more likely to follow suit.
But beware the pitfalls of training. Cyber-attacks are often difficult to explain without reverting to IT jargon, and that’s precisely where you’ll lose the attention of many employees. The person or team responsible for training must be able to translate technical language into common-sense precepts and guidelines everyone can understand. Training should also take place in an environment where people feel free to ask questions without being made to feel “computer illiterate.”
Wherever possible, find ways to make the learning experience both more personal and enjoyable. If you place awareness training in the context of their own lives, it’s more likely to make an impact. Be clear that the techniques you ask employees to adopt at their desks can, in many situations, apply to their home computer use as well.
Also explore creative methods for getting the word across – everything from Q&As about cyber-security in your company newsletter to friendly contests and lunch-and-learn workshops. “Just like anything else, if it’s not going to grab their attention, it won’t stick in their minds,” says security architect Matthew Pascucci. At the same time, he urges companies to complement these methods “with periodic tests designed to evaluate user awareness and to direct training to different areas of focus.”
Another drawback in the attempt to create a cyber-security culture is approaching the topic in an overly negative manner. Of course, the threats posed by hackers are very real, but too many stern admonitions about what employees shouldn’t do – and the dire consequences of ignoring these procedures – can establish a heightened fear of taking any independent action.
Instead, frame the need for information security awareness in ways that highlight its benefits to both employees and the organization. Staying on top of security threats will keep operations running smoothly; a goal everyone can embrace. Celebrating the successes of such a program makes employees feel they’re contributing to the well-being of the company, while helping to keep the costs of downtime and data loss to an absolute minimum.
Source: SCORE.org (in partnership with Paychex)
Copyright 2024 The Business Journal, Youngstown, Ohio.
